From baf31219d08ec470ca918112b55e264230d7b816 Mon Sep 17 00:00:00 2001
From: swissky <30409887+swissky@users.noreply.github.com>
Date: Fri, 10 Jul 2026 10:20:48 +0200
Subject: [PATCH] ci: opt in to checkout v7 fork guard in workflow_run apply
 jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

actions/checkout v7 refuses to check out fork PR code from a
workflow_run workflow unless the step explicitly sets
allow-unsafe-pr-checkout: true. Since the v7 bump (#1611), every
"Query Counts — Apply" and "Auto Format — Apply" run that reaches the
fork checkout fails with "Refusing to check out fork pull request
code", so fork PRs no longer get snapshot updates or auto-formatting
pushed back.

Both jobs were already designed for this trust boundary: they never
execute code from the fork tree — they only apply inert artifacts
produced by the trusted measure/format runs (JSON copies, git apply)
and push with a scoped app token via GIT_ASKPASS, with
persist-credentials: false. Opt in explicitly and document why the
checkout is safe.
---
 .github/workflows/auto-format-apply.yml  | 7 +++++++
 .github/workflows/query-counts-apply.yml | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/.github/workflows/auto-format-apply.yml b/.github/workflows/auto-format-apply.yml
index 14f347921a..439c36a284 100644
--- a/.github/workflows/auto-format-apply.yml
+++ b/.github/workflows/auto-format-apply.yml
@@ -149,6 +149,13 @@ jobs:
           repository: ${{ steps.pr.outputs.full_name }}
           ref: ${{ steps.pr.outputs.sha }}
           persist-credentials: false
+          # Reviewed opt-in to checkout v7's fork guard: no code from the
+          # fork tree is ever executed here. The steps below only `git apply`
+          # the patch from the trusted format artifact and run git
+          # add/commit/push — no scripts, hooks, or tooling from the
+          # checked-out tree. Credentials are not persisted; the push uses
+          # a scoped app token via GIT_ASKPASS.
+          allow-unsafe-pr-checkout: true
 
       - name: Apply patch
         if: steps.download.outputs.found == 'true'
diff --git a/.github/workflows/query-counts-apply.yml b/.github/workflows/query-counts-apply.yml
index d781dde516..61d9df7fe4 100644
--- a/.github/workflows/query-counts-apply.yml
+++ b/.github/workflows/query-counts-apply.yml
@@ -154,6 +154,13 @@ jobs:
           repository: ${{ steps.pr.outputs.full_name }}
           ref: ${{ steps.pr.outputs.sha }}
           persist-credentials: false
+          # Reviewed opt-in to checkout v7's fork guard: no code from the
+          # fork tree is ever executed here. The steps below only copy the
+          # inert snapshot JSONs from the trusted measure artifact and run
+          # git add/commit/push — no scripts, hooks, or tooling from the
+          # checked-out tree. Credentials are not persisted; the push uses
+          # a scoped app token via GIT_ASKPASS.
+          allow-unsafe-pr-checkout: true
 
       - name: Apply snapshots
         if: steps.download.outputs.found == 'true'